Microsoft 365 535 5.7.139: “Authentication unsuccessful” – SMTP AUTH and Basic auth disabled

Short answer: Microsoft 365 refused the username-and-password (Basic auth) login that your printer, app or script uses on smtp.office365.com. Fix: switch it to OAuth, or send through a relay connector or an email service. An admin can re-enable SMTP AUTH for one mailbox as a stopgap.

Coming: Microsoft 365 SMTP AUTH: Basic Authentication Off by Default at the End of December 2026

The bounce looks like this
535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Tenant. Visit https://aka.ms/smtp_auth_disabled for more information.
5.7.57 Client not authenticated to send mail. Error: 535 5.7.139 Authentication unsuccessful, basic authentication is disabled.
535 5.7.139 Authentication unsuccessful, the request did not meet the criteria to be authenticated successfully. Contact your administrator.
530 5.7.57 Client not authenticated to send mail …

What it means

Your device or app signs in to smtp.office365.com (port 587) with a username and password, and Exchange Online refused the login. The text after 5.7.139 says why: SMTP AUTH is turned off for the whole organisation or for that mailbox, or Basic auth is blocked by security defaults, a Conditional Access policy, an authentication policy or MFA on the account. 5.7.57 and 535 5.7.3 are the same failed login as the app reports it. Microsoft's current plan: Basic auth for SMTP AUTH is switched off by default for existing tenants at the end of December 2026, admins can still turn it back on, tenants created after that won't have it by default, and the final removal date will be announced in the second half of 2027. Personal Outlook.com and Hotmail accounts lost Basic auth on 16 September 2024; there is no switch to bring it back.

How to fix it

  1. Find what still signs in with a password: in the Exchange admin center go to Reports → Mail flow → SMTP AUTH clients report. The Authentication Protocol column shows Basic Auth or Modern Auth for each sender.
  2. Best fix: switch the app to OAuth 2.0. Many apps, plugins and newer printers have a “Microsoft 365 / Outlook” sign-in option (XOAUTH2). For your own code, register an app in Microsoft Entra with the SMTP.Send permission (SMTP.SendAsApp for unattended services), or send with Microsoft Graph sendMail. SMTP AUTH must still be enabled on the sending mailbox.
  3. Device can't do OAuth and has to mail outside addresses? Create an SMTP relay connector: Exchange admin center → Mail flow → Connectors → Add a connector, Connection from: Your organization's email server, authenticated by a TLS certificate or a static public IP that only you use. Point the device at your MX host (yourdomain-com.mail.protection.outlook.com) on port 25 and add the IP to SPF with the SPF generator.
  4. Only mailing colleagues? High Volume Email (smtp.hve.mx.microsoft, port 587) still accepts an HVE account's username and password but delivers to internal recipients only, and is billed per recipient. Direct send (MX host, no login) is internal-only too; Microsoft recommends it only as a last resort, says it is working on turning it off by default, and tenants with RejectDirectSend on bounce it with 550 5.7.68.
  5. Or give the device its own SMTP login at an email sending service (Amazon SES, Postmark, Brevo, Mailgun) and publish that service's SPF and DKIM records – see the setup guides. Microsoft is retiring Azure Communication Services Email on 30 September 2028, so don't start new setups on it.
  6. Stopgap while you migrate: an admin can enable SMTP AUTH for just the device's mailbox – Microsoft 365 admin center → Users → Active users → the user → Mail → Manage email apps → Authenticated SMTP, or Set-CASMailbox -Identity scanner@yourdomain.com -SmtpClientAuthenticationDisabled $false. It doesn't work while security defaults are on or a policy blocks Basic auth, and it will stop working when Microsoft removes Basic auth for good.
  7. App passwords don't get around this: they are Basic auth too. Old devices also fail if they can't do TLS 1.2, so update the firmware. Outlook.com and Hotmail users need an app that offers an Outlook.com (OAuth) sign-in.

Step-by-step for your device or app

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)

Check your domain now

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 28-page guide, checklist, 20+ providers.

Other bounce errors